Archive
7 May 2021
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
Unscored —
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Authentication Bypass can occur via Packet Replay. Remot…
-
Unscored —
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can retrieve recently used and running applica…
-
Unscored —
An issue was discovered in Emote Remote Mouse through 3.015. Attackers can close any running process by sending the pro…
-
Unscored —
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a runni…
-
Medium 5.4
IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network to obtain sensitive…
-
Medium 5.9
Nim stdlib httpClient does not validate peer certificates by default
Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyM…
-
Unscored —
An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues suc…
-
Medium 4.3
Creation of files outside the Download Folder through malicious PAR2 files
SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as …
-
Unscored —
The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains…
-
Medium 5.3
Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version…
-
Unscored —
The affected product is vulnerable to stack-based buffer overflow while processing over-the-air firmware updates from t…
-
Unscored —
Multiple integer overflow issues exist while processing long domain names, which may allow an attacker to remotely exec…
-
Unscored —
The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to…
-
Unscored —
The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, whic…
-
Unscored —
A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing…
-
Unscored —
Proofpoint Enterprise Protection (PPS/PoD) before 8.16.4 contains a vulnerability that could allow an attacker to deliv…
-
Unscored —
VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthor…
-
Unscored —
LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm.
-
Unscored —
LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm.
-
Unscored —
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenti…
-
Unscored —
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalida…
-
Unscored —
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote…
-
Unscored —
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through…
-
Unscored —
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment ter…
-
Medium 6.5
Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File Inclusion
Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file.
-
Medium 4.6
Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSS
Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additional…
-
Medium 4.6
Jun-He Technology Ltd. ERP POS - Stored XSS-2
Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s …
-
Medium 4.6
Jun-He Technology Ltd. ERP POS - Stored XSS-1
Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate…
-
High 8.4
Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Sna…
-
High 7.5
Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapd…
-
High 7.8
Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdrag…
-
High 7.3
Double free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec…
-
Medium 6.2CVE-2021-1906 Exploited
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Au…
KEV Nov 3, 2021 -
High 8.4CVE-2021-1905 Exploited
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon …
KEV Nov 3, 2021 -
Medium 6.8
Possible integer overflow due to improper length check while flashing an image in Snapdragon Consumer IOT, Snapdragon I…
-
Medium 6.8
Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snap…
-
High 8.4
A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Au…
-
Medium 5.9
Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, …
-
Medium 5.1
Out of bound read can happen in Widevine TA while copying data to buffer from user data due to lack of check of buffer …
-
High 7.8
Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdrag…